- Everyone Knows What "Cybersecurity" Means
- We Can Measure How Secure Our Systems Are
- The Primary Goal of Cybersecurity Is Security
- Cybersecurity Is About Obvious Risks
- Sharing More Cyber Threat Intel Will Make Things Better
- What Matters to You Matters to Everyone Else
- Product X Will Make You Secure
- Macs Are Safer Than PCs, Linux Is Safer Than Windows
- Open Source Software Is More Secure Than Closed Source Software
- Technology X Will Make You Secure
- Process X Will Make You Secure
- Faerie Dust Can Make Old Ideas Magically Revolutionary
- Passwords Should Be Changed Often
- Believe and Fear Every Hacking Demo You See
- Cyber Offense Is Easier Than Defense
- Operational Technology (OT) Is Not Vulnerable
- Breaking Systems Is the Best Way to Establish Yourself
- Because You Can, You Should
- Better Security Means Worse Privacy
- Further Reading
This chapter is from the book
This chapter is from the book
This chapter is from the book
Cyber Offense Is Easier Than Defense
A great many respected voices in cybersecurity have said, “the defense has a disadvantage because they have to defend against all attacks, while the offense only needs a single way in.” On the surface, this seems intuitively true. Defending many attack surfaces means resources are spread thinly. If all offensive resources are focused on a single attack at the time and method of the attacker’s choosing, how could that not favor the offense?
This point of view makes one strong assumption: Cyber attack is easy. As Bruce Schneier wrote, “Contrary to popular belief, government cyberattacks are not bolts out of the blue, and the attack/defense balance is more. . . well. . . balanced.”63 While criminal attacks such as large-scale phishing attempts are not discriminatory, they still cost the attacker because of a low success rate. Furthermore, the phishing email is only one component for the criminal who needs functional malware, command and control infrastructure, and a way to monetize stolen data. These days, ransomware attackers even offer customer service and tech support for their victims.64
Professor Rebecca Slayton at Cornell University thinks it is premature to say that offense has the advantage.65 First, she suggests reframing the conversation around relative utility or value. It is reasonable to associate high costs with defending high-value assets. Further, if the value of offense is relatively low, then the offense is not “favored.” For example, consider Stuxnet:
“This analysis suggests that the defense was likely less costly than the offense in the Stuxnet attack, contrary to dominant assumptions about cyber offense dominance. Perhaps most significantly, the value that the United States, Israel, and Iran all attach to Iran’s nuclear program appears to be much greater than the cost of either cyber offense or cyber defense, making it unlikely that leaders were focused on costs.”
This myth matters beyond simple misconception. It is unnecessarily discouraging for organizational leaders and cyber defenders who might feel they are always behind, chasing the attackers who have “easy” choices. Defenders need to try to understand the mind and behavior of an attacker. This is why some programs teach offensive techniques to students studying cybersecurity: Knowing the attacker mindset helps them defend better.66
The key to avoiding this pitfall is to be careful when opining that the offense has the upper hand. It’s not simply about relative costs—defense costs should be appropriately matched with the protected value. (Remember Courtney’s Laws from earlier: “We Can Measure How Secure Our Systems Are.”) We need not lament how much we spend on security or how big of an attack surface we must defend.